Best way to disable internet access on a Windows XP Home machine?

[NathanBWF]

We have a few night shift employees who are abusing their internet privileges. It's a small workgroup network, all running XP Home. They don't need internet access to do their job, however they still need to be able to telnet across the VPN connection to connect to the UNIX server to be able to work. Ideas on the best way to go about doing this? Other employees still need to have internet access at night, it's only on a couple of PC's that I need to disable it...

 

[Brazen]

We use Group Policy to set a proxy for IE that doesn't exist and disable the Connections page, so they can't remove the proxy setting.

 

[nweaver]

Originally posted by: Brazen
We use Group Policy to set a proxy for IE that doesn't exist and disable the Connections page, so they can't remove the proxy setting.

:thumbsup:


if possible, not sure with home. otherwise, if they arn't too savvy, manually put the proxy into IE's settings..


option 2: remove the default gateway, and add a single static route to get access to the unix machine.

 

[Fike]

block port 80 and 8080 at the router. Any cheap home router can do that. that will block all http communications.

fike

 

http://www.gratiskados.nl/index.php?ref=17168

 

[NathanBWF]

Originally posted by: Fike
block port 80 and 8080 at the router. Any cheap home router can do that. that will block all http communications.

fike

Right, but then everyone is screwed. We just want to disable a couple of PCs, not everyones.

 

[NathanBWF]

Originally posted by: nweaver

Originally posted by: Brazen
We use Group Policy to set a proxy for IE that doesn't exist and disable the Connections page, so they can't remove the proxy setting.

:thumbsup:


if possible, not sure with home. otherwise, if they arn't too savvy, manually put the proxy into IE's settings..


option 2: remove the default gateway, and add a single static route to get access to the unix machine.

This won't work being as how it's Windows XP home, and not in a client/server environment.

The static route thing might work...I'll need to check into it more.

Thanks for the replies!

 

[Fike]

then it gets a bit more complicated, but you should be able to setup a LAN group and only block those ports for the group. Some routers will let you set permissions by MAC address too.

fike

 

[Malak]

If I'm not mistaken, it is still legal to fire people for being bad employees.

 

[Brazen]

Originally posted by: NathanBWF

Originally posted by: nweaver

Originally posted by: Brazen
We use Group Policy to set a proxy for IE that doesn't exist and disable the Connections page, so they can't remove the proxy setting.

:thumbsup:


if possible, not sure with home. otherwise, if they arn't too savvy, manually put the proxy into IE's settings..


option 2: remove the default gateway, and add a single static route to get access to the unix machine.

This won't work being as how it's Windows XP home, and not in a client/server environment.

The static route thing might work...I'll need to check into it more.

Thanks for the replies!

Then I agree that Option 2 would be ok, and easy. Or to set up something they can not change, I give you:

Option3: set up a hosts file that has correct entries for the servers and then direct everything else to 127.0.0.1. The only thing I do not know though is it possible to use a wildcard for the hostname? eg:

127.0.0.1 *

?